Cyber Security Specialist

Tuknik Government Services, LLC a Koniag Government Services company, is seeking a Cyber Security Specialist to support TGS and our government customer in Oak Ridge, TN. The position is hybrid, requires 2 days onsite (varies but average 2 times every two weeks or so).

Benefits include medical, dental, and vision insurance, 401(k) retirement plan, paid time off, paid parental leave, life and disability insurance, flexible spending accounts, commuter benefits and tuition reimbursement.

Tuknik Government Services, LLC a Koniag Government Services company, is seeking an experienced Cybersecurity Specialist to provide independent technical, analytical, assessment, coordination, and documentation support to the Department of Energy's (DOE) Oak Ridge Office of Environmental Management (OREM). This position supports the Authorizing Official Designated Representative (AODR), the Safety, Security, & Waste Management (SSW) Branch Chief, the Risk Executive, and other Government officials in administering and overseeing the OREM Cybersecurity Program. The ideal candidate is a seasoned cybersecurity professional with deep expertise in Risk Management Framework (RMF) processes, continuous monitoring, security assessments, and Federal cybersecurity compliance, who can independently analyze complex technical evidence and provide clear, actionable recommendations to both technical and executive stakeholders. This position requires an active DOE Q clearance or DoD Top Secret (TS) clearance, or the ability to obtain one.

The Cybersecurity Specialist will serve as a Subject Matter Expert (SME) supporting the AODR and other Government officials in the oversight, assessment, and continuous improvement of the OREM Cybersecurity Program. This position reports to the Program Manager, with the COR (HQ) providing daily task direction and work assignments. The Contractor shall support, but shall not perform, inherently governmental decision-making or exercise authority reserved to Federal officials. Principal responsibilities will include but are not limited to:

AODR, RMF, and Authorization Support

• Attend cybersecurity, authorization, risk, assessment, and contractor oversight meetings with the AODR and other stakeholders as requested.
• Support the AODR throughout the system authorization and continuous monitoring lifecycle, including independent technical review of authorization packages and supporting evidence.
• Review System Security Plans (SSPs), security control implementation descriptions, assessment results, POA&Ms, implementation plans, impact assessments, risk categorizations, risk assessments, technical justifications, and other authorization artifacts for completeness, consistency, and technical sufficiency.
• Identify cybersecurity risks, control deficiencies, evidence gaps, authorization conditions, and residual-risk considerations and provide documented analysis and recommendations.
• Review proposed risk responses and POA&M content and provide recommendations concerning technical sufficiency, milestones, remediation priorities, and closure evidence.
• Support tracking of authorization conditions, findings, corrective actions, POA&Ms, and other risk-treatment activities through closure or Government disposition.
• Review HQ initiatives, Executive Orders, BODs, data calls, and other requirements and provide impact analyses and recommendations.
• Assess the application of applicable cybersecurity requirements across OREM information systems and provide documented recommendations for resolution of gaps and risks.

Continuous Monitoring and Security Assessments

• Plan and perform Government-authorized continuous monitoring and security control assessment activities for OREM system boundaries, including applicable ICS/OT, NSS, GSS, UCNI, and other designated environments. Develop or support assessment plans defining scope, systems, controls, evidence, assessment methods, schedule, personnel, technical testing, and Rules of Engagement (ROE).
• Use examination, interview, testing, technical validation, vulnerability analysis, and other approved assessment methods.
• Perform full Security Test and Evaluation (ST&E) activities when directed by the Government.
• Document assessment results in ISCM reports, SARs, ST&E reports, or other Government-approved formats.
• Support follow-up validation of remediation and closure evidence for assessment findings and POA&M items.

Vulnerability, KEV, and Technical Compliance Support

• Assess vulnerability and patch-management compliance for designated OREM boundaries, including CISA Known Exploited Vulnerabilities (KEV) and BOD 22-01 requirements. Analyze scan results, missing patches/updates, configuration weaknesses, false positives, compensating controls, and remediation evidence, and provide risk-based findings and recommendations.

Contractor Cybersecurity Oversight and Audit Support

• Support DOE oversight of contractor cybersecurity programs by reviewing evidence, assessing implementation of requirements, identifying gaps and risks, and providing documented recommendations.
• Support coordination of cybersecurity activities associated with internal/external audits, inspections, reviews, and assessments.
• Review new cybersecurity projects and significant system changes for integration of applicable requirements.
• Provide recommendations for optimization and continuous improvement of cybersecurity processes, metrics, governance, and risk-management practices.

HQ Data Call and Administrative Coordination Support

• Attend HQ data-call meetings as scheduled. Coordinate collection, consolidation, quality review, and status tracking of OREM contractor responses.
• Track due dates and identify late, incomplete, inconsistent, or unsupported responses.
• Communicate questions and clarification requests to HQ when authorized, and document responses. Prepare response packages, status reports, action trackers, and supporting documentation.
• Provide administrative assistance directly related to AODR cybersecurity duties as requested.

Technical Deliverables

• Prepare authorization package technical review memoranda, assessment plans, ISCM reports, SARs, POA&M review comments, vulnerability/KEV/patch analyses, risk summaries, trackers, audit-support results, HQ data-call packages, and monthly cybersecurity program status summaries in Government-approved formats, ensuring accuracy, traceability, and technical defensibility.

Education and Experience:

Required

• Bachelor's degree in Cybersecurity, Computer Science, Information Technology, or related field from an accredited college or university (or equivalent experience in lieu of degree).
• Significant experience in Information Technology (IT) and cybersecurity, including experience implementing or assessing cybersecurity solutions in diverse operating environments.
• Experience supporting Federal RMF, system authorization, security control assessment, continuous monitoring, POA&M management, and cybersecurity risk analysis strongly preferred.
• Active DOE Q clearance or DoD Top Secret (TS) clearance, or the ability to obtain one, as required for assigned duties.

Required Skills and Competencies

• Certified Information Systems Security Professional (CISSP) certification.
• Thorough familiarity with DOE O 205.1, EM Cybersecurity Program Plan (CSPP), NIST SP 800-53 Rev. 5, NIST SP 800-171, DOE/EM POA&M guidance, DOE O 206.1A, NIST SP 800-82 Rev. 3, NIST SP 800-137/137A, NIST SP 800-37 Rev. 2, and applicable EOs, BODs, and DOE directives.
• Functional understanding of IT and OT system components such as TCP/IP, network and host-based intrusion detection/prevention, vulnerability scanning, Windows and Unix/Linux operating systems, routers, switches, database management systems, and security tooling.
• Ability to independently analyze complex technical evidence and communicate risk and recommendations to technical and executive stakeholders.
• Demonstrated technical writing and report-development skills.
• Excellent verbal communication, analytical, and problem-resolution skills.
• Ability to manage multiple concurrent tasks and meet Government-established deadlines.
• Ability to work effectively as a team member while maintaining independent professional judgment, including under the direction of a COR providing daily task assignments.
• Ability to clearly distinguish advisory recommendations from Government decision-making authority and elevate matters requiring Government judgment appropriately.
• Ability to report to the Oak Ridge, TN site within two (2) hours of request during business hours, as needed.

Desired Skills and Competencies

• Experience supporting DOE or other Federal agency cybersecurity programs in an EM or similarly complex mission environment.
• Experience with ICS/OT security assessments and NIST SP 800-82 application.
• Experience supporting National Security Systems (NSS), General Support Systems (GSS), or UCNI environments.
• Familiarity with CISA Known Exploited Vulnerabilities (KEV) catalog and BOD 22-01 compliance processes.
• Experience coordinating HQ data calls and multi-contractor response consolidation.
• Experience developing Program Management Plans (PMPs) or Quality Assurance Plans (QAPs) in a Federal contracting environment.
• Additional certifications such as CISM, CAP, or Security+.

Our Equal Employment Opportunity Policy

The company is an equal opportunity employer. The company shall not discriminate against any employee or applicant because of race, color, religion, creed, ethnicity, sex, sexual orientation, gender or gender identity (except where gender is a bona fide occupational qualification), national origin or ancestry, age, disability, citizenship, military/veteran status, marital status, genetic information or any other characteristic protected by applicable federal, state, or local law. We are committed to equal employment opportunity in all decisions related to employment, promotion, wages, benefits, and all other privileges, terms, and conditions of employment.

The company is dedicated to seeking all qualified applicants. If you require an accommodation to navigate or apply for a position on our website, please get in touch with Heaven Wood via e-mail at accommodations@koniag-gs.com or by calling 703-488-9377 to request accommodations.

Koniag Government Services (KGS) is an Alaska Native Owned corporation supporting the values and traditions of our native communities through an agile employee and corporate culture that delivers Enterprise Solutions, Professional Services and Operational Management to Federal Government Agencies. As a wholly owned subsidiary of Koniag, we apply our proven commercial solutions to a deep knowledge of Defense and Civilian missions to provide forward leaning technical, professional, and operational solutions. KGS enables successful mission outcomes for our customers through solution-oriented business partnerships and a commitment to exceptional service delivery. We ensure long-term success with a continuous improvement approach while balancing the collective interests of our customers, employees, and native communities. For more information, please visit www.koniag-gs.com.

Equal Opportunity Employer/Veterans/Disabled. Shareholder Preference in accordance with Public Law 88-352